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Case Study: 1 

Consolidated Messenger 

Background 

Business Scenario 

You are the lead architect, developer, and web administrator of SharePoint 2013 for your 
company, Consolidated Messenger. Consolidated Messenger is a national company with 
hundreds of franchises. Consolidated Messenger focuses on bicycle-based courier services in 
metropolitan areas. 

Consolidated Messenger sells franchises to franchisees. Franchisees have three user types: 


Responsible for managing accounts and setting pick-up and 
drop-off locations for couriers 


Technical Scenario 
When a franchisee purchases a franchise, they are provided with: 


® access to Consolidated Messenger's SharePoint 2013 multi-tenant farm 
located at https://sp.consolidatedmessenger.com 

° access to a Customers list in the Corporate site collection, named 
CorporateSiteCollection, which includes a list of all Customers across all 
franchisees 

° a single site collection for each franchisee, named FranchiseeSiteCollection 

° an unlimited number of customer subsites for each franchisee 


Consolidated Messenger has funded the creation of three apps. 


Used by franchisees from their franchise locations to 
monitor the progress of the bicycle couriers 


Used by bicycle couriers to perform their day-to-day 
function of receiving and delivering packages 


Used to perform management of bicycle couriers, their 
routes, and their schedules 


CloudManager 


Solution Architecture 
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SharePoint Farm Design 
My Sites are not created for each Franchisee unless they are requested. 
Business Requirements 
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Franchise 
Manager 


Franchise 
Employee 


Courier 


SharePoint Access 


e Franchise Managers are site collection administrators for 
each franchise, 

e Franchise Managers may only access their site collection 
settings and not the settings of the web application. 

e Franchise Managers must be able to add users to a site 
in a People Picker contro! based on claims. 

e Franchise Managers must be able to search for claims 
by using the type-in control of the claims picker. The 
claims must be displayed by using a flattened structure. 

e Franchise Managers may access only their site collection 
settings and not the settings of the web application. 


e Franchise employees are customer subsite owners for 
each franchise. 

e Franchise employees must be able to read from the 
Customers list in the CorporateSiteCollection. 

e Franchise employees must have complete contro! over 
the customer subsites that is assigned to the 
the franchise. 


e No SharePoint access 


Technical Requirements 

Each Franchise site collection must include a SharePoint document library to store CSV files. 
FranchiseMonitor App 

Application Design 

Franchise employees use Microsoft Excel 2013 to create a list of pick-up and drop-off 
locations for each bicycle courier for each day. The spreadsheet is named Appointments.csv. 
Business Requirements 

The FranchiseMonitor app must allow a Franchise employee to upload Appointments.csv to a 
SharePoint document library in each Franchisee site collection, and send Appointments.csv 
to the CloudManager app. 

Technical Requirements 


The FranchiseMonitor app must display the courier's location on the bicycle 
courier's microfeed on the SharePoint farm if the courier has remained 
stationary for more than three minutes. 

The FranchiseMonitor app must be listed on the Site Contents page of the 
host web. 

The FranchiseMonitor app must use claims-based authentication, once 
launched, to authenticate the franchisee against an API provided by Margie's 
Travel. 

The FranchiseMonitor app must be deployed to all site collections by the 
SharePoint administrator. 

The FranchiseMonitor app must be immediately available to be installed on 
websites within the tenancy on a website-by-website basis to any tenant 
contained in the SharePoint farm. 
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The FranchiseMonitor app must be able to create lists within SharePoint to 
store records of the CSV files so that they may be sent to the CloudManager 


app. 


CourierMobile App 
Application Design 


Each bicycle courier for each franchise is provided a Microsoft Surface Pro 
device with LTE. Most bicycle couriers do not return their Microsoft Surface 
Pro devices back to their franchise locations nightly. 

The CourierMobile app runs on the bicycle courier's Microsoft Surface Pro 
device. 

Margie's Travel provides an API to enable external developers to 
authenticate by using OAuth and claims-based authentication. Many couriers 
are members of Margie's Travel. 

The CourierMobile app receives Microsoft Outlook appointments and 
Outlook appointment cancellations from the CloudManager app. The 
appointments include the address of the location for pick-up or drop-off. 


Business Requirements 


The CourierMobile app must display a Bing map to display route data when 
Outlook appointments or appointment cancellations are received. 

The CourierMobile app must capture the location of the Microsoft Surface 
Pro device on a regular interval. This data must be captured regardless of 
whether the device has connectivity. 

The CourierMobile app must be able to connect to the SharePoint Customers 
list and verify whether the account belongs to the franchisee to avoid pickups 
or deliveries to customers that do not belongs to the franchisee. When the 
CourierMobile add accesses the Customers list, it must only read its contents 
with the minimum permissions necessary. 


Technical Requirements 


The CourierMobile app must provide the ability to authenticate by using the 
courier's Microsoft account or the Margie's Travel API. 

The CourierMobile app must include a custom sign-in page that includes 
branding from Consolidated Messenger and Margie's Travel, based on the 
authentication provider selected by the user. 

The CourierMobile app must be able to capture more than 30 million data 
points of location data daily as they occur and upload the location data to the 
cloud when connected to the Internet. 


CloudManager App 
Application Design 
CloudManager processes two sets of data: 


Updates to the list of appointments received from the FranchiseMonitor app 
Geo-location data received from the CourierMobile app 
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Business Requirements 
The CloudManager app must implement business logic that parses Appointments.csv and 
geo-location data and sends Appointments or Appointment cancellations to the 
CourierMobile app. 
Technical Requirements 
° The CloudManager app must elastically scale to capture courier location data 
as the number of bicycle couriers increases or decreases. 
° The CloudManager app must process bicycle courier location data from a 
data store capable of storing more than 30 million items. 
Solution Code 


MyClaimsProvider.cs 


CPO1l [SharePointPermissionAttribute (SecurityAction.LinkDemand, ObjectModel = true) } 
CPO2 {SharePointPermissionAttribute (SecurityAction.IinheritanceDemand, ObjectModel = 


true) ] 

CPOS 

CPO4 public class MyClaimsProvider : Microsoft.SharePoint.Administration.Claims.SPCla 
imProvider 

CPOS { 

CPOE public abstract String Name; 

CPO7 

CPOs protected abstract void FiilSchema( ); 

CPOS protected abstract void FiliClaimTypes( )- 

CPi0 protected abstract void FiiiClaimValueTypes(..-); 
CPil protected abstract void FillEntityTypes(...); 
CPi2 

CP1i3 Public abstract bool SupportsResolve; 

CP14 protected abstract void FillResolve(...); 

CPi5 protected abstract void FillResolve(...); 

CP16 

CP17 public abstract bool SupportsSearch; 

CF18 protected abstract void FiliSearch( de 

CP19 

CP20 } 


AppManifest.xml for Franchise Monitor app 
AMO1 <?xml version="1.0" encoding="utf-8" ?> 
AMO2 <App xmilns="http://schemas.microsoft.com/sharepoint/2012/app/manifest" 


AMO3 Product ID="{ 4a07f3bd-803d-45f2-a710-b9e944c3396e}" 

AMO4 Version="1.0.0.0" 

AMOS SharePointMinVersion="15.0.0.0" 

AMO6 Name="FranchiseMonitor" 

AMO7 > 

AMOS <Properties> 

AMOS <Title>Franchise Monitor App</Title> 

AM10 <StartPage>~remoteAppUri/Home.aspx?iStandardTokens}</StartPage> 
AM11 </Properties> 

AM1z2 


AM13 <AppPrincipali> 
AM14 <RemoteWebApplication Clientid="lee82b34-7clb-47ib-—b27e-ffFf272accdSé4" /> 
AM15 </AppPrincipai> 


AM1i6 

AM17 <AppPermissionkKequests> 

AM18 <AppPermissionRequest Scope="http://sharepoint/content/sitecollection/web/ 
list" Right="Write"/> 

AM13 </AppPermissionRequests> 

AM20 </App> 
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Question: 1 


You need to ensure that the CourierMobile app determines whether the franchisee owns the 
account. 
What should you do? 


A. Use OAuth and App only security. Request the Read right from the http://sharepoint/content/ 
sitecollection/web/list scope URI. 

B. Use OAuth and App+User security. Request the Read right from the http://sharepoint/content/ 
sitecollection scope URI. 

C. Use SPSecurity.RunWithElevatedPrivileges to connect to SharePoint and read from the Accounts 
list in the site collection. 

D. Use the SharePoint user credentials of the bicycle messenger to connect to SharePoint and read 
from the Accounts list in the site collection. 


Answer: B 


* SharePoint users three types of authorization policies. The user-only policy requires only that the 
call to SharePoint include an authenticated user identity. The app-only policy requires only that the 
call include only an authenticated app identity. The user+app policy requires that the call include 
both kinds of authenticated identities. 

* You may have already heard that OAuth 2.0 plays an important role in the authentication and 
authorization of apps for SharePoint. It does, but it is not necessarily a part of the authorization story 
for every app for SharePoint. If you plan to build an app for SharePoint that runs in an remote web 
application and communicates back to SharePoint using server-side code, you will need to use 
OAuth. 

Scenario: 

* The CourierMobile app must be able to connect to the SharePoint Customers list and verify 
whether the account belongs to the franchisee to avoid pickups or deliveries to customers that do 
not belongs to the franchisee. When the CourierMobile add accesses the Customers list, it must only 
read its contents with the minimum permissions necessary. 

* Margie's Travel provides an API to enable external developers to authenticate by using OAuth and 
claims-based authentication. Many couriers are members of Margie's Travel 

Reference: Authorization and authentication of apps for SharePoint 2013 


Question: 2 


A franchisee deletes several sites from the franchise's site collection. The franchisee site collection 
administrator must recover the sites. 

You need to instruct the franchisee site collection administrator on how to access the page to recover 
the sites. 

What should the site collection administrator do to get to the appropriate page? 


A. Select General Settings for the Web Application in Central Administration and change the second 
stage Recycle Bin settings to 100 percent. 

B. Select General Settings for the Web Application in Central Administration and change the first 
stage Recycle Bin settings to 0 days. 
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C. Select the Recycle Bin on the Site Settings page. Choose the appropriate sites and select Restore 
Selection. 
D. Select the Recycle Bin in the Quick Launch page. Choose the appropriate sites and select Restore 
Selection. 


Answer: D 


To restore a deleted site or workspace directly from the Site Collection Recycle Bin: 

1. Click Recycle Bin on the Quick Launch. 

2. On the Site Name Recycle Bin page, above the list of deleted objects, click the Site Collection 
Recycle Binlink. 

3. On the Site Collection Administration Recycle Bin page, under Select a View, make sure that 
Deleted from end user Recycle Bin is selected. 

4. Locate the site or workspace that you want to restore. 

5. Select the check box next to the site or workspace that you want to restore, and then click Restore 
Selection. 

Incorrect: 

Not A, not B: The sites have been deleted. They need to be restored. A and B are wrong because 
modifying the Recycle Bin settings after the sites are deleted will have no effect on the deleted sites. 
Reference: Restore a deleted object from a SharePoint Recycle Bin 


Question: 3 


You need to ensure that the CloudManager app can write route progress check-ins to the courier's 
microfeed. 
What should you do? (Each correct answer presents part of the solution. Choose all that apply.) 


A. Ensure that SP.RequestExecutor.js can be accessed in a browser window with no errors. 

B. Ensure that the CloudManager app has the Manage permission request scoped to the URL for the 
franchisee's My Site. 

C. Ensure that the MySite host is provisioned for each franchisee. 

D. Ensure that all cookies are made available between the My Site and the CloudManager app 
domain. 

E. Ensure that the CloudManager app has the Write permission request scoped to the URL for the 
franchisee's My Site. 

F. Ensure that SP.UserProfiles.js can be accessed in a browser window with no errors. 


Answer: A, B, D, E 


* From scenario: 

/ Business Requirements 

The FranchiseMonitor app must allow a Franchise employee to upload Appointments.csv to a 
SharePoint document library in each Franchisee site collection, and send Appointments.csv to the 
CloudManager app. 

/ The FranchiseMonitor app must display the courier's location on the bicycle courier's microfeed on 
the SharePoint farm if the courier has remained stationary for more than three minutes. 

/ The CloudManager app must implement business logic that parses Appointments.csv and geo- 
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location data and sends Appointments or Appointment cancellations to the CourierMobile app. 


Question: 4 


DRAG DROP 

Some franchisees want to launch the FranchiseMonitor app from a link named Launch Franchise 
Monitor that is displayed next to the name of the user who is currently logged in. Other franchisees 
do not want to have the link present. The link must be contained within the same out-of-the-box 
control, as shown in the screenshot below: 


elreteriei-averiea Administrators Ts ? 


You need to configure support for the Launch Franchise Monitor link. 
Which four actions should you perform in sequence? (To answer, move the appropriate actions from 
the list of actions to the answer area and arrange them in the correct order.) 
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y 
Answer Area 


Add a new user control named 
SuiteLinksDelegate. 


Ensure that the class inherits from 
the WebPart class and 
overrides the RenderControl method. 


Add a new code module named 
SuiteLinksDelegate. 


Create a new SharePoint 2013 Empty 
Project. 


Add a reference to the contro! to the 
AppManifest file. 


| Add a reference to the control to an 


empty elements file, 


-y — 


Ensure that the class inherits from the 
UserControl class and 
overrides the Render method. 


æ w 


Create a new App for SharePoint 2013 
project. 


Answer: 


Box 1: 
Create a new SharePoint 2013 Empty 
Project. 

Box 2: 
Add a new user control named 
SuiteLinksDelegate. 


Box 3: 
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Ensure that the class inherits from the 
UserControl class and 
overrides the Render method. 


Box 4: 


Add a reference to the control to an 
empty elements file. 


Note: 

Box 1 (see box 4): Empty elements are most often used to define SharePoint project items that lack a 
project or project item template in Visual Studio. When you add an empty element to your project, a 
node named EmptyElement[x] (where [x] is a unique number) is created. EmptyElement[x] contains 
a single file that is named Elements.xml. Use XML statements to define the desired elements in 
Elements.xml. 

Box 2: SuiteLinksDelegate delegate control allow us to add links in right suite bar like 
"Newsfeed","Sites" etc. 


hxk 


(Report Newsfeed SkyDrive Sites Administratory <% 7 


Box 3: User Control Code Behind: 

protected override void Render(HtmlTextWriter writer) etc. 

Box 4: For all these delegate controls , you need to add a reference in Elements.xml file to specify the 

control id and control source properties: 

<?xml version="1.0" encoding="utf-8"?> 

<Elements xmIns="http://schemas.microsoft.com/sharepoint/"> 

<Control ControlSrc="/_controltemplates/15/MyDelegateControls/UserControl.ascx' 

Id="DelegateControllD" //ID of DelegateControl e.g. "SuiteLinksDelegate" 
Sequence="1" /> 

</Elements> 

Reference: New Delegate Controls in SharePoint 2013 


Question: 5 


You need to implement the custom claims provider for the SharePoint farm. 
Which code segments should you implement? (Each correct answer presents part of the solution. 
Choose all that apply.) 
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TA public abstract bool SupportsEntityInformation; 
protected abstract void FillClaimsForEntity(Uri context, SPClaim entity, 
List<SPClaim> claims) ; 


B protected abstract void FiliSchema (SPProviderSchema schema) ; 
protected abstract void FiliClaimTypes(List<String> claimTypes); 
protected abstract void FillClaimValueTypes(List<String> claimValueTypes) ; 
protected abstract void FiliEntityTypes(List<String> entityTypes); 


LE public abstract bool SupportsHierarchy; 
protected abstract void FillHierarchy(Uri context, String[{) entityTypes, 
String hierarchyNodelID, 
int numberOfLevels, bool includeEntityData, SPProviderHierarchyTree hierarchy); 


TD public abstract bool SupportsResoive; 
protected abstract void FililResolve(Uri context, String{] entityTypes, 
String resolveiInput, 
List<PickerEntity> resolved); 
protected abstract void FiilResoive(Uri context, String{] entityTypes, 
SPClaim resolveinput, 
List<PickerEntity> resoived); 


["E. public abstract String Name; 


L E. public abstract bool SupportsSearch; 
protected abstract void FililSearch(Uri context, String[]} entityTypes, 
String searchPattern, 
String hierarchyNodeID, int maxCount, SPProviderHierarchyTree searchTree); 


A. Option A 
B. Option B 
C. Option C 
D. Option D 
E. Option E 
F. Option F 


Answer: B, D, F 


The following are required methods when writing a claims provider. 
B: Required for claims picker 
Claims can be displayed in the people picker control through claims picking. The following methods 
in the SPClaimProvider class are required methods if you want to implement claim picking in the 
people picker control. 
protected abstract void FillSchema(SPProviderSchema schema); 

protected abstract void FillClaimTypes(List<String> claimTypes); 

protected abstract void FillClaimValueTypes(List<String> claimValueTypes); 

protected abstract void FillEntityTypes(List<String> entityTypes); 
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D: Required for resolving claims in the type-in control of the claims picker 
If you want to be able to resolve claims by using the type-in control of the claims picker, you must 
implement the following methods in the SPClaimProvider class. 
public abstract bool SupportsResolve 
protected abstract void FillResolve(Uri context, String[] entityTypes, String resolvelnput, 

List<PickerEntity> resolved); 

protected abstract void FillResolve(Uri context, String[] 
F: Required for searching for claims in the claims picker 
If you want to be able to search for claims in the claims picker, you must implement the following 
property and method in the SPClaimProvider class. 
public abstract bool SupportsSearch 

protected abstract void FillSearch(Uri context, String[] entit 
* From scenario: 
MyClaimsProvider.es 


CPO1 [ShareP ntPermissionAttribute (SecurityAction.LinkDemand, ObjectModel = true) } 
CPO2 {SharePointPermissionAttribute (SecurityAction.InheritanceDemand, ObjectModel = 
true) ]} 

CPOS 

CPO4 public class MyClaimsProvider : Microsoft.SharePoint .Administration.Claims.SPCla 
imProvider 

CPOS 

CPOE public abstract String Name; 

CPO7 

CPOs Protected abstract void FiilSchema ( G 

CP09 protected abstract void FillClaimTypes( F? 

CP190 protected abstract void FiilClaimValueTypes ( ls 

CP11 protected abstract void FillEntityTypes( )? 

CPi2 

CP1i3 public abstract bool SupportsResolve; 

CPié4 protected abstract void FillResolve( J-i 

CP15 protected abstract void FillResolve( )e 

CP16 

CPi? public abstract bool SupportsSearch; 

CPis protected abstract void FiliSearch ( 

CPi9 

CP20 


Reference: How to: Create a claims provider in SharePoint 2013 


Question: 6 


You need to set the appropriate permissions for the franchise employees' customer list and customer 
subsite access. 
What should you do? 


A. Add franchise employees to the Members group in the CorporateSiteCollection site collection. 
Break inheritance at the franchisee subsite level. Create a custom role definition at the franchisee 
subsite level. Add franchise employees to the custom role. 
B. Create a custom role definition in the CorporateSiteCollection site collection with Limited Access 
to the Customers list. Add franchise employees to the custom role at the CorporateSiteCollection site 
collection. Break inheritance at the subsite level. Add franchise owners to the Owners group at the 
subsite level. 

C. Create a custom role definition in the CorporateSiteCollection site collection with Limited Access 
to the Customer list. Add franchise employees to the custom role. Allow full inheritance of the role 
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definition and permissions at the site level. 

D. Add franchise employees to the Visitors group in the CorporateSiteCollection site collection. Break 
inheritance at the franchisee subsite level. Create a custom role definition at the subsite level with 
Full Control permissions. Add franchise employees to the custom role. 


Answer: B 


Question: 7 


You need to create rules in the CourierMobile app based on the ItemType that arrives. 
For which ItemTypes should you test? (Each correct answer presents part of the solution. Choose all 
that apply.) 


A. IPM.Schedule.Meeting.Tent 

B. IPM.Note 

C. IPM.Schedule.Meeting.Request 
D. IPM.Appointment 

E. IPM.Schedule.Meeting.Cancelled 
F. IPM.Schedule.Meeting.Pos 

G. IPM.Schedule.Meeting.Neg 


Answer: D, E 


From scenario: 

* The CourierMobile app receives Microsoft Outlook appointments (D) and Outlook appointment 
cancellations (E) from the CloudManager app. The appointments include the address of the location 
for pick-up or drop-off. 


Question: 8 


You need to meet the requirements for data storage for the CourierMobile app and the 
CloudMananger app. 

Which technologies should you use? (Each correct answer presents part of the solution. Choose all 
that apply.) 


A. Windows Azure SQL Database 
B. SharePoint content database 
C. Secure Store 

D. SQL Server Express LocalDB 

E. SharePoint list 


Answer: A, D 


A: SQL Azure in the cloud. 

D: LocalDB is a lightweight version of Express that has the same programmability features, but it runs 
in user mode and has a fast, zero-configuration installation and a short list of prerequisites. 

From scenario: 
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* CourierMobile App 

The CourierMobile app must be able to capture more than 30 million data points of location data 
daily as they occur and upload the location data to the cloud when connected to the Internet. 

* Cloudmanager App 

/ The CloudManager app must elastically scale to capture courier location data as the number of 
bicycle couriers increases or decreases. 

/ The CloudManager app must process bicycle courier location data from a data store capable of 
storing more than 30 million items. 


Question: 9 


HOTSPOT 

You need to select the app experience for the CourierMobile app. 

In the App for Office 2013 dialog window, which configuration option should you select? (To answer, 
select the appropriate configuration option in the answer area.) 


a | Choose the type of app you want to create and where you want it to appear 


7 [O Task pane app in: 
The app appears in the task pane of the Office application. 


[v] Excel 
[v] Word 
[V] PowerPoint 


[V] Project 


By © Content app in Excel 
The app appears in the body of an Excel document. 


Answer: 
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oO | Choose the type of app you want to create and where you want it to appear 


a Task pane app in: 


The app appears in the task pane of the Office application, 
Iv. Excel 

[V] Word 

[V] PowerPoint 


iv] Project 


eres D Content app in Excel 
= The app appears in the body of an Excel document. 


aom ooo] 


i 


Scenario: The CourierMobile app receives Microsoft Outlook appointments and Outlook 
appointment cancellations from the CloudManager app. The appointments include the address of 
the location for pick-up or drop-off. 


Question: 10 


You need to create a custom sign-in page to allow the users of the FranchiseMonitor app to 
authenticate against SharePoint and Margie's Travel API. 
What should you do? 


A. Create an app for SharePoint. Set the trust level to Sandbox solution. Create an application page 
that writes a cookie named FedAuth. Deploy the app and configure the Sign In Page URL in Central 
Administration Authentication Provider for the zone. 
B. Create an app for SharePoint. Set the trust level to Farm solution. Create an application page that 
writes a cookie named FedAuth. Deploy the app and configure the Sign In Page URL in Central 
Administration Authentication Provider for the zone. 
C. Create an app for SharePoint. Set the trust level to Farm solution. Create an application page that 
writes a cookie named ASPXAUTH. Deploy the app and configure the Sign In Page URL in Central 
Administration Authentication Provider for the zone. 
D. Create an app for SharePoint. Set the trust level to Sandbox solution. Create an application page 
that writes a cookie named ASPXAUTH. Deploy the app and configure the Sign In Page URL in Central 
Administration Authentication Provider for the zone. 


Answer: B 


The new claims-based authentication in SharePoint 2010 does not use the ASPXAUTH cookie, instead 
it uses the FedAuth cookie. 

SharePoint 2013 tracks FedAuth cookies in the new distributed cache service using Windows Server 
AppFabric Caching. 

Scenario: The FranchiseMonitor app must use claims-based authentication, once launched, to 
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authenticate the franchisee against an API provided by Margie's Travel. 
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